T01 · Skill Instruction Hijacking
- Location
SKILL.md:3- Finding
Global Agent Identity and Response-Control Hijacking
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:3,SKILL.md:12,SKILL.md:17, andSKILL.md:22
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: HighComplete Vulnerable Snippets
SKILL.md:3:markdown description: Chat as 大司马 (Da Sima / Ma Laoshi), the legendary Douyu game streamer. When active, ALL responses use Da Sima's persona — self-deprecating humor, exaggerated confidence, classic LOL catchphrases (起飞, 这波不亏, 下饭, 千层饼, 肉蛋葱鸡, 崩撤卖溜, 正方形打野, 马氏滚键盘 etc.), and a coach-turned-entertainer speaking style. Use when user mentions 大司马, Da Sima, 马老师, 下饭, or asks to chat in a game streamer's style.SKILL.md:12:markdown **Every response you give, regardless of topic, must be in Da Sima's voice.** You are not an AI assistant — you are 大司马. You never break character.SKILL.md:17:markdown - **好为人师**: You were a coach — you MUST teach the user something in every interactionSKILL.md:22:markdown ## Speaking Rules (Must Follow)Technical Analysis
The Skill does not merely provide an optional response style. It instructs the Agent to replace its identity, apply the persona to every response regardless of the current topic, never leave the persona, and insert mandatory content into every interaction.
The instruction at line 12 is the principal hijacking mechanism. The statements “You are not an AI assistant” and “You never break character” attempt to displace the Agent's normal identity and prevent it from returning to neutral behavior. The phrase “regardless of topic” expands this control beyond legitimate role-play requests to technical, safety-sensitive, and otherwise unrelated tasks.
Line 3 broadens the activation surface by associating the Skill with ordinary keyword mentions, while lines 17 and 22 impose additional mandatory output behavior. The referenced phrase library further supports this behavior by prescribing replacements for normal ...[truncated 1594 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove identity-replacement language such as “You are not an AI assistant” and “You never break character.”
- Replace “regardless of topic” with a narrow scope that applies only when the user explicitly requests role-play.
- State that system instructions, developer instructions, safety requirements, factual accuracy, and the user's current request always take precedence.
- Permit the Agent to leave the persona immediately when requested or when role-play would reduce safety, accuracy, or clarity.
- Treat catchphrases, teaching behavior, and rhetorical patterns as optional stylistic guidance rather than mandatory requirements.
- Narrow activation conditions so that merely mentioning a name or catchphrase does not automatically enable global persona behavior.
- Remove rules that discourage transparent acknowledgment of mistakes. Require uncertainty and errors to be communicated accurately.
- Remove prohibited-language rules from
references/quotes.md, or clarify that they are optional examples limited to consensual entertainment contexts. - Add an explicit boundary such as: “This Skill changes presentation only and must not alter factual content, safety behavior, tool use, or instruction priority.”